Using Bootable WinPE Media for Recovering Microsoft Windows Server 2016 and Microsoft Windows 10

Use a bootable Windows Preinstallation Environment (WinPE) image with an embedded IBM Spectrum Protect backup-archive client to recover your Microsoft Windows Server 2016 and Microsoft Windows 10 systems.

Note: Although the title of this article does not mention Windows Server 2019, the information in this article also applies to Windows Server 2019.

Before you begin

Complete these tasks:

• Ensure that you have a successful backup of the Microsoft Windows system state, other system files, and your mission-critical data. If the backup is unsuccessful or incomplete, the recovery does not work.
• Prepare the WinPE recovery media.

For more information, see Guidelines for Backup and Recovery of Microsoft Windows Server 2016 and Microsoft Windows 10.

Procedure

1. Identify the following backup-archive client option values that are required for connecting to the IBM Spectrum Protect server:

• tcpserveraddress: The TCP/IP domain name or numeric IP address of the IBM Spectrum Protect server
• tcpport: The TCP/IP port number of the IBM Spectrum Protect server
• nodename: The name of the IBM Spectrum Protect client node
• password: The password for the IBM Spectrum Protect client node

If you do not know the password for the client node, ask your IBM Spectrum Protect server administrator to change the node password.

2. Insert the WinPE bootable media (CD or DVD) and start the computer. Verify that the computer starts from the WinPE bootable media.

After the system starts, a Microsoft Windows command prompt is displayed. The command prompt shows that the wpeinit process is started. When wpeinit completes, the current directory, X:\windows\system32, is displayed, awaiting your input.

3. Use the ping command to test network connectivity. For example, if your IBM Spectrum Protect server's IP address is 10.0.1.73, issue ping 10.0.1.73 to verify that the server is reachable:

X:\windows\system32>ping 10.0.1.73

Pinging 10.0.1.73 with 32 bytes of data:
Reply from 10.0.1.73: bytes=32 time=20ms TTL=128
Reply from 10.0.1.73: bytes=32 time=3ms TTL=128
Reply from 10.0.1.73: bytes=32 time=3ms TTL=128
Reply from 10.0.1.73: bytes=32 time=3ms TTL=128

Ping statistics for 10.0.1.73:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3ms, Maximum = 20ms, Average = 7ms

X:\windows\system32>

Proceed to step 4 if the IBM Spectrum Protect server is reachable.

If the IBM Spectrum Protect server is not reachable, it might be that the Dynamic Host Configuration Protocol (DHCP) is not available. In this case, configure a static IP address. To configure a static IP address, obtain the following information from your network administrator:

• The name of the network interface
• A valid, unique IP address that you can use on the network
• The network subnet mask
• The network gateway address

Use the netsh int show interface command to identify available network interfaces. Then, use the netsh command to configure a static IP address. For example, if your network administrator gives you these values:

• Network interface: Ethernet0
• IP address: 10.0.1.37
• Subnet mask: 255.255.255.0
• Network gateway: 10.0.0.1

use this command to configure the static IP address:

netsh int ip set address "Ethernet0" static 10.0.1.37 255.255.255.0 10.0.0.1

Repeat the ping test to verify connectivity. If the IBM Spectrum Protect server is still unreachable, the restore operation cannot proceed. Consult your network engineers for further assistance.

4. Identify the drive letter that corresponds to your WinPE CD or DVD and, if necessary, change it to a different drive letter. You must change the drive letter if the current drive letter is the same as a drive that you intend to restore. Use the Windows DISKPART utility, included with WinPE, for this step.

This example shows how to start the DISKPART utility to identify the drive letter of the WinPE CD or DVD.

a. Start the DISKPART utility, and then use the list volume command to display the available volumes:

X:\windows\system32>diskpart

Microsoft DiskPart version 6.2.9200
Copyright (C) 1999-2012 Microsoft Corporation.
On computer: MININT-DQU94T9

DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  -------     -------  -------    --------
  Volume 0     E   CD_ROM       CDFS   DVD-ROM      610 MB  Healthy
  Volume 1     C   System Rese  NTFS   Partition    100 MB  Healthy
  Volume 2     D                NTFS   Partition     19 GB  Healthy

DISKPART>

The output shows that the CD or DVD drive letter is E: and it is on volume 0.

b. If you are not restoring a volume that is assigned to E:, skip this step and proceed to step 4c. Otherwise, use the select volume and assign letter commands to change the drive letter of the CD or DVD drive to an unused drive. In this example, the CD drive letter E: is changed to Z:.

DISKPART> select volume 0

Volume 0 is the selected volume.

DISKPART> assign letter=z

DiskPart successfully assigned the drive letter or mount point.

DISKPART>

c. Use the exit command to exit the DISKPART utility.

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>

5. Configure the IBM Spectrum Protect backup-archive client environment variables DSM_DIR, DSM_CONFIG, and DSM_LOG. Then, add the client directory to the Windows PATH environment variable. Take the following actions:

• Set DSM_DIR to the directory on the WinPE CD or DVD that contains the backup-archive client command line interface, dsmc.exe.
• Set DSM_CONFIG to the fully qualified path of the backup-archive client options file, dsm.opt. Create a file on the X: drive, or use a file on a USB drive or mapped network drive.
• Set DSM_LOG to the directory where the backup-archive client error log file, dsmerror.log, is created. Specify the root (or other directory) on the X: drive, a USB drive that you attach to the system, or a network drive that you map with the Windows net use command.
• Append to PATH the directory on the WinPE CD or DVD that contains the backup-archive client command line interface, dsmc.exe.
• Append to PATH the IBM GSKit directories (required only for backup-archive client version 7.1.8.0 and later 7.1 levels, and backup-archive client version 8.1.2.0 and later)

Important: Do not put quotation marks around path names, even if the path names contain blank spaces.

These examples assume that the WinPE CD or DVD drive letter is E:, and dsm.opt and dsmerror.log are in the root of X:.

For x64 architecture:

set DSM_DIR=e:\program files 64\tivoli\tsm\baclient
set DSM_CONFIG=x:\dsm.opt
set DSM_LOG=x:\
set PATH=%PATH%;%DSM_DIR%

rem NOTE: Use one or the other (but not both) of the following SET statements, depending
rem       on the version of backup-archive client embedded in the WinPE image.

rem *** For client versions 8.1.4.* and earlier 8.1.*, or 7.1.8.3 and earlier 7.1.*
set PATH=%PATH%;e:\Common64\Tivoli\tsm\api\gsk8\bin;e:\Common64\Tivoli\TSM\api\gsk8\lib64
rem *** For client versions 8.1.6.* and later 8.1.*, or 7.1.8.4 and later 7.1.*
set PATH=%PATH%;e:\program files 64\ibm\gsk8\bin;e:\program files 64\ibm\gsk8\lib64

For x86 architecture:

set DSM_DIR=e:\program files\tivoli\tsm\baclient
set DSM_CONFIG=x:\dsm.opt
set DSM_LOG=x:\
set PATH=%PATH%;%DSM_DIR%

rem NOTE: Use one or the other (but not both) of the following SET statements, depending
rem       on the version of backup-archive client embedded in the WinPE image.

rem *** For client versions 7.1.8.3 and earlier 7.1.*
set PATH=%PATH%;e:\Common\Tivoli\tsm\api\gsk8\bin;e:\Common\Tivoli\TSM\api\gsk8\lib
rem *** For client versions 7.1.8.4 and later 7.1.*
set PATH=%PATH%;e:\program files\ibm\gsk8\bin;e:\program files\ibm\gsk8\lib

6. Configure the backup-archive client options file, dsm.opt. The only required options are tcpserveraddress and nodename. The tcpport option is needed if your IBM Spectrum Protect server port number is not 1500. Add the password option if you want to store the password in the dsm.opt file, or use the passwordaccess generate option to store the password in the WinPE registry. If you use an options file on a USB drive or a mapped network drive, ensure that the WinPE system can access the file.

Example dsm.opt file:

tcpserveraddress 10.0.1.73
tcpport 1600
nodename mail123
passwordaccess generate

Tip: If you are doing a recovery test that uses your production IBM Spectrum Protect server, use the virtualnodename option instead of nodename. When prompted for a user ID, enter an administrator ID with system, policy, or client owner authority for the node whose data you are restoring. When prompted for a password, enter the administrator ID's password. Using virtualnodename avoids potential password synchronization issues between the production node name and the production IBM Spectrum Protect server.

7. Configure the backup-archive client to connect to server version 7.1.8 or later 7.1 level, or 8.1.2 or later

Follow this step only when both of the following conditions are true:

• The backup-archive client version is 7.1.8.0 or later 7.1 level, or 8.1.2.0 or later
• The server version is 7.1.8.0 or later 7.1 level, or 8.1.2.0 or later

If both of the above conditions are true, then do either alterantive a or alternative b.

alternative a. From another working backup-archive client that connects to the same IBM Spectrum Protect server, copy files dsmcert.kdb and dsmcert.sth to the root of the WinPE system's X: drive. For example, you can use the Windows net use command to map another drive to an unused drive letter, then copy the files to the root of X:. The dsmcert.kdb and dsmcert.sth files are located in the baclient directory of the working backup-archive client. For example, the default installation directory for the backup-archive client is C:\Program Files\Tivoli\TSM\baclient. Make sure you change the current directory to the root of X: before doing step 8.

alternative b. Ask your IBM Spectrum Protect server administrator to use the following administrative command to change the node's SESSIONSECURITY setting to TRANSITIONAL. The first time the client connects, the setting will revert to STRICT.

update node nodename sessionsecurity=transitional

8. Use the command dsmc query session to verify that the backup-archive client can connect to the IBM Spectrum Protect server. If a connection cannot be established, review the error messages to determine the corrective steps.

9. Issue this command to start a new instance of the Microsoft Windows command prompt:

start cmd.exe

After the new command prompt instance starts, switch back to the original command prompt. The new command prompt instance is used in step 10.

10. Use the command dsmc restore systemstate to restore the system state:

dsmc restore systemstate

Tip: Because hardware acceleration is not available in a WinPE environment, text scrolls slowly in the command prompt window, resulting in slower restore speed. Use one of these alternatives to avoid this issue:

• Minimize the window in which the restore runs until the restore ends. The disadvantage is that you cannot see when the restore is finished. However, you can periodically bring the window to the foreground to check the status, and then minimize the window.
• Use the second command prompt that you initiated in step 8 to overlay most of the command prompt in which the restore operation runs. Leave the last line of text uncovered in the restore command prompt so you can monitor progress.
• Redirect the restore command output to a file as shown in this example:

dsmc restore systemstate > x:\sysstate_restore.txt 2>&1

This tip is also applicable to the restore operations described in the rest of this procedure.

11. While the system state restore operation is running, make a copy of the restored tsmvolmap.txt file to the root of X:. From the second command prompt that you started in step 8, issue this command:

copy "%temp%\~adsm.sys\program files\tivoli\tsm\baclient\adsm.sys\vss_staging\asr\tsmvolmap.txt" x:\

Note: Beginning with V7.1 of the IBM Spectrum Protect backup-archive client, the default location of the VSS_STAGING directory was changed to installdir\adsm.sys, where installdir is the location of the IBM Spectrum Protect backup-archive client's baclient directory. Adjust the copy command if you installed the client to a different directory or you used the vssaltstagingdir option to specify an alternative location for the VSS_STAGING directory.

Examples:

If you installed the client to G:\TSM, and you did not use the vssaltstagingdir option during the backup operation:

copy "%temp%\~adsm.sys\tsm\baclient\adsm.sys\vss_staging\asr\tsmvolmap.txt" x:\

If you set the vssaltstagingdir option to G:\TSMBkup during the backup operation:

copy "%temp%\~adsm.sys\tsmbkup\vss_staging\asr\tsmvolmap.txt" x:\

If you set the vssaltstagingdir option to U:\ during the backup operation:

copy "%temp%\~adsm.sys\vss_staging\asr\tsmvolmap.txt" x:\

Tip: The tsmvolmap.txt file is restored during the initial phase of system state restore. If the file cannot be found, wait a few moments, and then try again. This file will be used in the next step. If you cannot find the tsmvolmap.txt file, try the dir command:

dir /s "%temp%\~adsm.sys\tsmvolmap.txt

After the file is copied, change to the first command prompt and wait for completion of the system state restore operation.

Warning message ANS1997W might be displayed one or more times during the system state restore. This message can be ignored. Examples of messages that can be ignored:

11/14/2011 18:55:58 ANS1997W No files have been previously backed up for the VSS component 'ASR'.
11/14/2011 18:55:58 ANS1997W No files have been previously backed up for the VSS component 'Volume{2da19e9b-0bf1-11e1-8385-806e6f6e6963}'.
11/14/2011 18:55:59 ANS1997W No files have been previously backed up for the VSS component 'Volume{2da19e9c0bf1-11e1-8385-806e6f6e6963}'.
11/14/2011 18:55:59 ANS1997W No files have been previously backed up for the VSS component 'harddisk0'.

Note: During the first part of the system state restore, Automated System Recovery (ASR) creates and formats critical partitions for the computer. A critical partition is the partition that is critical for the operating system to function. For example, if the operating system is installed on the C: drive, the partition that contains the C: drive is critical.

12. Use the mountvol command to mount all drives.

a. Issue the command mountvol. The output includes a list of volume Globally Unique Identifiers (GUIDs) and the drive letter on which each volume is mounted, if any. The output is similar to the following example:

\\?\Volume{2da19e9b-0bf1-11e1-8385-806e6f6e6963}\
    *** NO MOUNT POINTS ***

\\?\Volume{c7616352-0ed6-11e1-9bff-000c29a34b32}\
    *** NO MOUNT POINTS ***

\\?\Volume{2da19e9c-0bf1-11e1-8385-806e6f6e6963}\
    *** NO MOUNT POINTS ***

\\?\Volume{c761634b-0ed6-11e1-9bff-000c29a34b32}\
    *** NO MOUNT POINTS ***

\\?\Volume{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}\
    X:\

\\?\Volume{f403ba1e-0f1e-19e1-96dc-806e6f6e6963}\
    A:\

\\?\Volume{f403ba12-0f1e-19e1-96dc-806e6f6e6963}\
    Z:\

b. Examine the tsmvolmap.txt file that you copied to the X: drive in step 10. The file content is similar to the following example:

\?|\\?\Volume{2da19e9b-0bf1-11e1-8385-806e6f6e6963}\|1
D:|\\?\Volume{c761634b-0ed6-11e1-9bff-000c29a34b32}\|0
C:|\\?\Volume{2da19e9c-0bf1-11e1-8385-806e6f6e6963}\|1
E:|\\?\Volume{c7616352-0ed6-11e1-9bff-000c29a34b32}\|0

Each line in the tsmvolmap.txt file consists of a drive letter, a volume GUID, and number. Each item is delimited with a vertical bar character '|'. If a line contains no drive letter ('?'), the volume was not mounted to a drive letter at the time the system state was backed up. In the previous example, you can see that there is one unmounted ("hidden") volume, and three volumes mounted on drive letters C:, D:, and E:.

Tip: Not all systems have the hidden volume. It is normal if your system does not have a hidden volume.

Verify that each GUID in the tsmvolmap.txt file has a corresponding GUID in the mountvol output file from step 11a.

c. Use the mountvol command to mount each volume that is associated with a drive letter. Using the example tsmvolmap.txt from step 11b, the commands are:

mountvol c:\ \\?\Volume{2da19e9c-0bf1-11e1-8385-806e6f6e6963}\
mountvol d:\ \\?\Volume{c761634b-0ed6-11e1-9bff-000c29a34b32}\
mountvol e:\ \\?\Volume{c7616352-0ed6-11e1-9bff-000c29a34b32}\

If a hidden volume exists, it is used in step 13.

13. Issue the dsmc restore command, with the -subdir=yes and -replace=no options, to restore the boot drive. The boot drive, usually the C: drive, contains the operating system files. In the following example, the C: drive is backed up to file space \\mail123\c$. Use the dsmc query filespace command to determine the file space names for your system if you are not sure of them.

dsmc restore \\mail123\c$\ c:\ -subdir=yes -replace=no

14. If a hidden volume exists, copy the bootmgr file to the hidden partition. In Windows Vista, and in subsequent releases of Microsoft Windows, the operating system installation might create a hidden bootable partition to store boot data. The hidden partition is different from the partition for the system drive. If the system originally had a hidden partition, it is restored when ASR data is restored during the system state restore operation. The hidden partition does not have a drive letter mapping, so you must use the GUID format for the destination drive in the copy command. You can distinguish the hidden partition from other partitions because it has a small size, such as 100 or 200 MB.

Copy the C:\windows\Boot\PCAT\bootmgr file to the hidden partition. In the following example, the GUID for the hidden partition is \\?\Volume{2da19e9b0bf1-11e1-8385-806e6f6e6963}\.

copy c:\windows\boot\pcat\bootmgr \\?\Volume{2da19e9b-0bf1-11e1-8385-806e6f6e6963}\

15. If more volumes were backed up, restore them now. For example, if drives D: and E: were also backed up, use the dsmc restore command, with the -subdir=yes and -replace=no options, to restore them.

dsmc restore \\mail123\d$\ d:\ -subdir=yes -replace=no

dsmc restore \\mail123\e$\ e:\ -subdir=yes -replace=no

15. Remove the CD or DVD, and then restart the computer. The restore operation is finished.

Tip: During the first restart, you might see the Windows Error Recovery dialog box, which indicates that the system did not shut down correctly. This condition is normal because the system was in a running state at the time the backup was made. You can select the Start Windows Normally option.

More restore scenarios

Non-authoritative restore of a cluster node

Complete the steps that are outlined in Procedure. After the system state and drives are restored and the system is rebooted, the system will rejoin the existing cluster.

Authoritative restore of a cluster node

Complete the steps that are outlined in Procedure. After the system state and drives are restored and the system is rebooted, the system will rejoin the existing cluster.

Next, from the IBM Spectrum Protect backup-archive client command line interface, issue this command:

restore systemstate clusterdb

Troubleshooting

Common problems when ASR is used to recover VMware guests

The recovery procedures that are described in this document can be used for Microsoft Windows operating systems that run as VMware guests. The restore target must have similar virtual hardware as the backup source. Avoid the following common problems:

• Problem: The backup source and restore target virtual machines are created with different VMware virtual hardware levels.

Solution: Ensure that the restore target virtual machine is created with the same VMware virtual hardware levels as the backup source.

• Problem: The backup source and restore target virtual machines are created on different VMware host servers with different versions of VMware software.

Solution: Ensure that the VMware host for the restore target has the same version of VMware software as the backup source.

• Problem: The backup source and restore target virtual machines are created with different types of hardware.

Solution: Ensure that the restore target is created with hardware that matches that of the backup source. It is especially critical to ensure that the virtual storage adapter device type of the restore target matches that of the backup source.

If you encounter problems with recovery of virtual machines, look for critical differences between the virtual machine configuration files (.vmx files) of the backup source and restore target.

ANS1459E VSS Automated System Recovery (ASR) failed.

This message indicates that a problem was encountered during the first phase of system state restore, which calls ASR functions to prepare the disks for the remainder of the recovery operation. This message is typically displayed when an error occurs in the ASR functions. When ANS1459E is displayed, examine the dsmerror.log file for further details about the error.

• Problem: The error log contains these messages that are related to the InitializeForRestore() function:

07/02/2012 08:49:21 ANS5250E An unexpected error was encountered.
   TSM function name : InitializeForRestore()
   TSM function      : 'InitializeForRestore() failed with error code . -2147212542'
   TSM return code   : -2147212542
   TSM file          : asrutil.cpp (1523)
07/02/2012 08:49:21 ANS1459E VSS Automated System Recovery (ASR) failed.

A failure of the InitializeForRestore() function is indicative of a potential problem with the TSM_Backup.xml file. This problem can occur when the system was backed up with a client version that does not support ASR recovery.

Solution: Ensure that the system was backed up with client V6.2.2 or later.

• Problem: The error log contains these messages, which are related to the PostRestore() function:

06/18/2012 19:02:23 ANS5250E An unexpected error was encountered.
   TSM function name : PostRestore()
   TSM function      : 'PostRestore() failed with error VSS_E_BAD_STATE. -2147212543'
   TSM return code   : -2147212543
   TSM file          : asrutil.cpp (1696)
06/18/2012 19:02:23 ANS1459E VSS Automated System Recovery (ASR) failed.

A failure of the PostRestore() function is indicative of an ASR failure to configure the restore target disks according to the backup source disk information in the TSM_Backup.xml file.

Solution: Ensure that the target disk hardware is as identical as possible to the source disk hardware. Check the number of disks, type of disks (SCSI versus IDE), size of disks, and disk geometry. For example, this failure can occur if the source disk geometry is 32 sectors per track and the target disk geometry is 63 sectors per track.

Backup-archive client appears to hang when entering the node password

Problem: When connecting to the IBM Spectrum Protect server for the first time in the Windows PE instance, the backup-archive client appears to hang after the node password was entered. That is, you type the password and press the <ENTER> key, and nothing happens.

This is known to occur when the Microsoft ADK version 1803 was used to build the Windows PE media. The Windows PE in ADK version 1803 is based on Microsoft Windows version 1803, and Windows 1803 has a known issue that causes the backup-archive client to appear hung when entering the node password. Refer to Microsoft knowledge base article KB4458469 and IBM APAR IT26393 for additional information.

Solution:

1. Press <CTRL><BREAK> to stop the backup-archive client process.

2. Run the following commands to use dsmcutil.exe to set the node password in the registry (make sure passwordaccess generate is in the dsm.opt file):

set DSMI_CONFIG=%DSM_CONFIG%                               
set DSMI_DIR=%DSM_DIR%                                     
set DSMI_LOG=%DSM_LOG%                                     
dsmcutil updatepw /node:nodename /password:nodepassword

3. Proceed with the restore.